Hash Generator
Developer ToolsGenerate MD5 and SHA-family hashes from any text, computed locally in your browser using the Web Crypto API — nothing you type is sent to a server.
—
—
—
—
—
MD5 and SHA-1 are shown for compatibility with existing systems, but neither is considered secure for passwords or security-sensitive checksums — see the guide below for what to use instead.
What a hash function does
A hash function takes an input of any size and produces a fixed-length string of characters — the hash — such that the same input always produces the same hash, but even a tiny change to the input (a single flipped character) produces a completely different, unpredictable-looking hash. Crucially, a good hash function is a one-way street: you can't reconstruct the original input from the hash alone, which is exactly the property that makes hashes useful for verification without needing to store or transmit the original data.
Common, legitimate uses
Developers use hashes to verify file integrity — comparing a downloaded file's hash against a publisher's published hash confirms the file wasn't corrupted or tampered with in transit, since even a single altered byte produces a completely different hash. Git uses SHA-1 hashes internally to identify every commit and object in a repository. Hashes are also used as content-addressed cache keys, to detect duplicate files without comparing their full contents byte by byte, and — with the right algorithm and additional safeguards like salting — as part of how systems store password verification data without storing the actual password.
Why MD5 and SHA-1 are shown, but flagged
Both MD5 and SHA-1 are cryptographically broken for security purposes — researchers have demonstrated practical ways to engineer two different inputs that produce the same hash (a "collision"), which defeats the core guarantee a security-sensitive hash needs to provide. They're still included here because they remain common in older systems, some file-integrity checks, and general-purpose non-security use (like a quick duplicate-detection key), where a broken collision-resistance guarantee doesn't actually matter for the task. They should not be used for passwords, digital signatures, or anything where an attacker being able to deliberately engineer a collision would cause real harm.
What to use instead for security-sensitive work
For file integrity checks and general-purpose hashing today, SHA-256 is the practical default — it's fast, well-supported, and has no known practical collision attacks. For password storage specifically, a raw hash from this tool (even SHA-256) still isn't the right choice on its own — passwords need a purpose-built, deliberately slow algorithm like bcrypt, scrypt, or Argon2, which are designed to resist brute-force guessing in a way general-purpose hash functions like SHA-256 are explicitly not, since SHA-256's speed (a feature for file integrity) is a liability against an attacker trying billions of password guesses per second.
How to use Hash Generator
- 1Type or paste the text you want to hash.
- 2View the MD5, SHA-1, SHA-256, SHA-384, and SHA-512 results.
- 3Copy whichever hash you need.
Frequently asked questions
Is MD5 safe to use?
Not for security purposes — MD5 is cryptographically broken and shouldn't be used for passwords or digital signatures. It's still fine for non-security uses like quick duplicate detection.
Which hash should I use for a password?
None of the hashes here directly — passwords should use a purpose-built, deliberately slow algorithm like bcrypt, scrypt, or Argon2, not a general-purpose hash like SHA-256.
Can I reverse a hash back into the original text?
No — hash functions are one-way by design. The only way to "crack" a hash is to guess inputs and check whether they produce the same hash, which is why weak or predictable inputs (like short passwords) are vulnerable even with a strong hash function.
Why do different inputs sometimes look similar in the hash?
They shouldn't, meaningfully — a well-designed hash function is built so that even a one-character change in the input produces a completely different, unrelated-looking hash output.
Is my text uploaded anywhere?
No — hashing runs entirely in your browser using the Web Crypto API (for SHA hashes) and a local JavaScript implementation (for MD5).